Description

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T21:17:43.543Z",
  "pubdate": "2026-08-13T21:17:43.543Z",
  "executiveSummary": "A vulnerability exists in IBM Documentation Offline versions 1.0.0 through 1.4.1 that introduces a remote code execution risk due to improper control of file paths. This security flaw enables remote attackers to manipulate file paths within the application logic, bypassing intended directory boundaries to access, overwrite, or execute arbitrary system files.\nThe primary impact of this vulnerability is the potential execution of arbitrary code within the context of the running application, which can compromise the integrity, confidentiality, and availability of the host system. The affected systems include localized deployments of IBM Documentation Offline. Risk implications are severe, as successful exploitation could allow an unauthorized remote attacker to leverage file path manipulation vectors to execute unauthorized payloads without requiring complex interaction, depending on the operational configuration.\nAttacker capabilities include remote exploitation vectors where crafted requests containing path traversal sequences can be injected into vulnerable file-handling routines. Exploitation requirements rely on network reachability to the vulnerable application interface and the presence of improper path sanitization mechanisms. Remediation requires applying official vendor updates or patches as soon as they become available.",
  "technicalDetails": "The vulnerability stems from improper control of file paths, commonly classified as a path traversal or arbitrary file access flaw leading to remote code execution. Within the affected versions of IBM Documentation Offline, the application logic fails to sufficiently validate, sanitize, or canonicalize user-supplied input or file path parameters before utilizing them in file system operations.\nThe root cause lies in the inadequate implementation of boundary checks when processing file references or resource loading requests. When an untrusted input containing traversal sequences such as dot-dot-slash patterns is processed by the vulnerable component, the application resolves the path relative to the root directory rather than restricting access to the designated safe storage directory.\nThe attack flow proceeds as follows: First, a remote attacker crafts a malicious request containing directory traversal sequences or absolute file paths directed at the vulnerable file-handling component of IBM Documentation Offline. Second, the application processes the unsanitized input, inadvertently traversing outside the intended base directory to access unauthorized file system locations. Third, by leveraging this improper path control, the attacker can write, overwrite, or reference executable files, script files, or system templates.\nUltimately, the payload behavior involves the execution of arbitrary code when the application or the underlying operating system subsequently processes or executes the manipulated file. The affected versions comprise IBM Documentation Offline 1.0.0 through 1.4.1. Network exposure is present if the application interface is accessible via a network boundary, allowing remote exploitation. Authentication and privilege requirements depend on the specific endpoint exposed, but the vulnerability inherently permits unauthorized path manipulation by remote entities.\nPost-exploitation impact includes full system compromise, unauthorized data disclosure, modification of critical application binaries, and execution of malicious payloads with the privileges of the service account running IBM Documentation Offline."
}